# Equivalent for API v2 - addons

**URL:** <https://community.developer.atlassian.com/t/equivalent-for-api-v2-addons/102891>\
**Category:** General Discussion\
**Tags:** rest-api\
**Created:** [September 25, 2026, 8:16am UTC](https://community.developer.atlassian.com/t/equivalent-for-api-v2-addons/102891 "2026-09-25T08:16:34Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![adam.labus](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/adam.labus/32/39809_2.png) [@adam.labus](https://community.developer.atlassian.com/u/adam.labus)\
**Post date:** [September 25, 2026, 8:16am UTC](https://community.developer.atlassian.com/t/equivalent-for-api-v2-addons/102891/1 "2026-09-25T08:16:35Z")

</div>

Hi everyone,

Until now, API (v2) allowed for the retrieval of quite useful information about any app on the marketplace **without requiring authentication** , example:

[https://marketplace.atlassian.com/rest/2/addons/com.itlab.jira.plugins.extender/versions/latest?application=jira&hosting=datacenter](https://marketplace.atlassian.com/rest/2/addons/com.itlab.jira.plugins.extender/versions/latest?application=jira&hosting=datacenter)

Unfortunately, the new version (v3) does not offer this capability.  
Interestingly, when analyzing network traffic from Jira DC, it turns out that Jira DC still uses this API (v2) and relies on it to check for new versions within the UPM.

Is there an equivalent endpoint that doesn’t require authentication, or are there additional parameters that can be used to get the API to return results (similar to how Jira DC does it)?

Cheers

Adam

---

<div class="post-metadata">

**Author:** ![Mihai\_leanzero](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/mihai_leanzero/32/55980_2.png) [@Mihai\_leanzero](https://community.developer.atlassian.com/u/Mihai_leanzero)\
**Post date:** [September 29, 2026, 5:24am UTC](https://community.developer.atlassian.com/t/equivalent-for-api-v2-addons/102891/2 "2026-09-29T05:24:17Z")

</div>

Hi @adam.labus,

There isn’t one. Every app-software and app-listing endpoint in the v3 spec is marked mpac\_authed, and an unauthenticated GET comes back 401.

Don’t lean on v2 either. The changelog (CHANGE-3257) says v2 was switched off on June 30, 2026, yet your exact latest-version URL still returns 200 to a plain curl today while the same request with a Chrome user agent gets 410 API\_DEPRECATED. Not something to build on.

If the check runs inside customer DC instances, don’t ship a token with the app. I’d put a small service of yours in front that calls v3 with a service-account API token, caches the latest version, and let the app hit that. Is that the setup, or is it a one-off script?